diff --git a/bin/fetch-openapi.sh b/bin/fetch-openapi.sh
index 22f2f73..ff02ec8 100755
--- a/bin/fetch-openapi.sh
+++ b/bin/fetch-openapi.sh
@@ -29,9 +29,10 @@ curl -fsS "${AUTH_HEADER[@]}" "$URL" -o "$OUT"
 
 # Verify it's actually JSON with an `openapi` key — oatpp sometimes returns
 # HTML on 401 which would silently land here otherwise.
-python3 -c "
+python3 - "$OUT" <<'PY'
 import json, sys
-d = json.load(open('$OUT'))
-assert 'openapi' in d, 'not an OpenAPI spec (missing \"openapi\" key)'
-print(f\"  openapi={d['openapi']}, paths={len(d.get('paths', {}))}\")
-"
+path = sys.argv[1]
+d = json.load(open(path))
+assert 'openapi' in d, 'not an OpenAPI spec (missing "openapi" key)'
+print(f"  openapi={d['openapi']}, paths={len(d.get('paths', {}))}")
+PY